Skip to content

Commit d4e5cd2

Browse files
committed
Report credentials for new login level 15
1 parent dc253ef commit d4e5cd2

File tree

1 file changed

+33
-14
lines changed

1 file changed

+33
-14
lines changed

modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb

Lines changed: 33 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ def initialize(info = {})
1515
'Name' => 'Cisco ASA SSL VPN Privilege Escalation Vulnerability',
1616
'Description' => %q{
1717
This module exploits a privilege escalation vulnerability for Cisco
18-
ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
18+
ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
1919
level 15.
2020
},
2121
'Author' =>
@@ -236,24 +236,43 @@ def run_host(ip)
236236

237237
if creds
238238
print_good("#{peer} - Successfully added level 15 account #{creds.join(", ")}")
239-
240239
user, pass = creds
241-
242-
report_hash = {
243-
:host => rhost,
244-
:port => rport,
245-
:sname => 'Cisco ASA SSL VPN Privilege Escalation',
246-
:user => user,
247-
:pass => pass,
248-
:active => true,
249-
:type => 'password'
250-
}
251-
252-
report_auth_info(report_hash)
240+
report_escalated_creds(user, pass)
253241
else
254242
vprint_error("#{peer} - Failed to created user account on Cisco SSL VPN")
255243
end
256244
end
257245
end
258246

247+
def report_escalated_creds(username, password)
248+
status = Metasploit::Model::Login::Status::SUCCESSFUL
249+
250+
service_data = {
251+
address: rhost,
252+
port: rport,
253+
service_name: 'https',
254+
protocol: 'tcp',
255+
workspace_id: myworkspace_id
256+
}
257+
258+
credential_data = {
259+
origin_type: :service,
260+
module_fullname: self.fullname,
261+
private_type: :password,
262+
private_data: password,
263+
username: username
264+
}
265+
266+
credential_data.merge!(service_data)
267+
credential_core = create_credential(credential_data)
268+
login_data = {
269+
core: credential_core,
270+
access_level: 'Level 15',
271+
status: status,
272+
last_attempted_at: DateTime.now
273+
}
274+
login_data.merge!(service_data)
275+
create_credential_login(login_data)
276+
end
277+
259278
end

0 commit comments

Comments
 (0)